Binance's $6.36 billion theft tests advisors' crypto exposure

Binance disclosed on Oct. 29 that $6.36 billion in digital assets had been moved from its wallets in unauthorized withdrawals. The theft is forcing advisors to re-examine where crypto risk actually sits in client portfolios.

Binance estimated about $6.36 billion left wallets across 10 blockchains, most of it within roughly 20 minutes, InvestmentNews reported. The exchange said about $3 billion has been identified and frozen and pledged to cover all losses; withdrawals resumed in phases on Nov. 1, with Binance saying about 95% of the stolen amount is covered. The FBI confirmed on Oct. 31 that North Korea's TraderTraitor hacking unit was behind the attack. A compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions, according to Binance's posts on X.

The SEC's Division of Examinations listed operational resiliency, cybersecurity and protection of customer information among its fiscal 2027 priorities in an Oct. 23 release. That puts a crypto sleeve inside a named exam focus even when the client owns Coinbase shares or an ETF rather than tokens on an exchange, making custody and cyber documentation part of the file and not just the position size.

The Bitwise/VettaFi 2026 Benchmark Survey of 299 advisors found 32% invested in crypto for client accounts in 2025, up from 22% in 2024, with crypto equity ETFs the preferred vehicle for 2026. That ten-point jump in a year means a single exchange's custody failure now reaches accounts that hold no exchange tokens at all.

Coinbase fell more than 13%, Circle more than 9% and Strategy about 8% on Oct. 30, the day after the disclosure, according to Sid Yenamandra, founder and CEO of SurgeONE.ai. None of the three was breached, and Coinbase and Strategy had reported third-quarter results on Oct. 29, so part of the decline reflected company-specific news. Coinbase, which custodies the iShares Bitcoin Trust, described its cold-storage changes as precautionary after the breach, as Private Wealth Daily previously reported.

Scott Dooley is chief investment officer at Sowell Management, the $6.8 billion Arkansas RIA that promoted Dooley to CIO in October, as Private Wealth Daily previously reported. He said holding several companies in one industry is not the same as being diversified because correlations tend to rise when confidence is shaken. "For advisors, the question is how much risk the exposure adds to the overall portfolio and whether clients are being adequately compensated for taking that risk," Dooley said.

For an advisor following the survey's preference into crypto equity ETFs, the Oct. 30 session is the stress case that matters: three listed companies repriced on an event at an exchange none of them operated, while the exam file that will be reviewed in fiscal 2027 asks what the advisor knew about the custody underneath.